Performing DNS Enumeration And Zone Transfer

# Find authoritative name servers
dig NS example.com +short
# ns1.example.com.
# ns2.example.com.

# Get SOA record for zone metadata
dig SOA example.com +short
# ns1.example.com. admin.example.com. 2024031501 3600 900 604800 86400

# Enumerate all common record types
dig example.com ANY +noall +answer

# Get MX records (mail servers)
dig MX example.com +short
# 10 mail.example.com.
# 20 mail-backup.example.com.

# Get TXT records (SPF, DKIM, DMARC, verification)
dig TXT example.com +short

# Check for DMARC policy
dig TXT _dmarc.example.com +short

# Check for DKIM selectors
dig TXT default._domainkey.example.com +short
dig TXT selector1._domainkey.example.com +short
dig TXT google._domainkey.example.com +short

# Get SRV records for common services
dig SRV _sip._tcp.example.com +short
dig SRV _ldap._tcp.example.com +short
dig SRV _kerberos._tcp.example.com +short

# Attempt AXFR zone transfer against each name server
dig AXFR example.com @ns1.example.com
dig AXFR example.com @ns2.example.com

# Use host command for zone transfer
host -t axfr example.com ns1.example.com

# Use dnsrecon for automated zone transfer attempts
dnsrecon -d example.com -t axfr

# If zone transfer succeeds, save the output
dig AXFR example.com @ns1.example.com > zone_transfer_results.txt

# Test for IXFR (incremental zone transfer)
dig IXFR=2024031500 example.com @ns1.example.com

# Use dnsenum for comprehensive enumeration
dnsenum --dnsserver ns1.example.com --enum -f /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt -r example.com -o dnsenum_output.xml

# Use dnsrecon with brute force
dnsrecon -d example.com -t brt -D /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt

# Use gobuster for fast DNS brute forcing
gobuster dns -d example.com -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-20000.txt -t 50 -o gobuster_dns.txt

# Use subfinder for passive subdomain discovery
subfinder -d example.com -all -o subfinder_results.txt

# Use amass for comprehensive enumeration (passive + active)
amass enum -d example.com -passive -o amass_passive.txt
amass enum -d example.com -active -brute -o amass_active.txt

# Combine and deduplicate results
cat subfinder_results.txt amass_passive.txt amass_active.txt gobuster_dns.txt | sort -u > all_subdomains.txt

# Reverse DNS lookup on discovered IP ranges
dnsrecon -d example.com -t rvl -r 10.10.0.0/24

# PTR record enumeration for IP range
for ip in $(seq 1 254); do
  result=$(dig -x 10.10.1.$ip +short 2>/dev/null)
  if [ -n "$result" ]; then
    echo "10.10.1.$ip -> $result"
  fi
done

# Use Nmap for reverse DNS on a subnet
nmap -sL 10.10.0.0/24 | grep "(" | awk '{print $5, $6}'

# Check for DNS cache snooping (information about queried domains)
dig @ns1.example.com www.competitor.com +norecurse

# Check DNSSEC validation
dig example.com +dnssec +short
dig DNSKEY example.com +short
dig DS example.com +short

# Test for DNS rebinding vulnerability
# Check if the DNS server has a short TTL that could enable rebinding
dig example.com +noall +answer | grep -i ttl

# Check for open recursive resolver (misconfiguration)
dig @ns1.example.com google.com +recurse
# If it resolves, the server is an open resolver

# Check for wildcard DNS records
dig nonexistent-subdomain-xyz123.example.com +short
# If it resolves, a wildcard record exists

# Test DNS over HTTPS/TLS support
# DoH test
curl -s -H 'accept: application/dns-json' 'https://dns.google/resolve?name=example.com&type=A'

# Verify SPF record for email security
dig TXT example.com +short | grep "v=spf1"
# Check for overly permissive SPF (+all, ?all)

# Resolve all discovered subdomains to IP addresses
while read subdomain; do
  ip=$(dig +short A "$subdomain" | head -1)
  if [ -n "$ip" ]; then
    echo "$subdomain,$ip"
  fi
done < all_subdomains.txt > resolved_subdomains.csv

# Identify unique IP addresses and their locations
cut -d',' -f2 resolved_subdomains.csv | sort -u > unique_ips.txt

# Check for internal IP addresses leaked via DNS
grep -E "^10\.|^172\.(1[6-9]|2[0-9]|3[01])\.|^192\.168\." resolved_subdomains.csv > internal_ip_leaks.txt

# Use httpx to probe web services on discovered subdomains
cat all_subdomains.txt | httpx -title -status-code -tech-detect -o httpx_results.txt

# Screenshot web services for documentation
cat all_subdomains.txt | httpx -screenshot -o screenshots/